P7 r8 fixes: lazy mounts catch ProviderNotActiveError (503 not 500), wg redeem added to PUBLIC_ROUTES (redemption is sessionless), live-curl probe script

dashcaddy-api/src/app.js

@@ -788,7 +788,12 @@ async function createApp() {
   // factory requires a provider at construction; get one only when the
   // WireGuard provider is registered, else mount a 503 stub.
   const p7WgProviderFactory = () => {
-    const prov = getActiveProvider();
+    let prov = null;
+    try {
+      prov = getActiveProvider();
+    } catch (_inactive) {
+      return null; // registry throws ProviderNotActiveError when inactive
+    }
     return prov && prov.id && prov.id() === 'wireguard' ? prov : null;
   };
   let p7WgRedeemRouter = null;
@@ -820,7 +825,12 @@ async function createApp() {
   let p7ForwardAuthRouter = null;
   const p7ForwardAuthLazy = (req, res, next) => {
     if (!p7ForwardAuthRouter) {
-      const prov = getActiveProvider();
+      let prov = null;
+      try {
+        prov = getActiveProvider();
+      } catch (_inactive) {
+        prov = null; // registry throws ProviderNotActiveError when inactive
+      }
       if (!prov) {
         return res.status(503).json({ error: 'network provider not active' });
       }

dashcaddy-api/src/utilities/middleware.js

@@ -403,6 +403,10 @@ module.exports = function configureMiddleware(app, {
     // gate would deadlock every protected site. Prefix (trailing slash)
     // covers GET + POST on the canonical /network/forward-auth/ URI.
     { path: '/api/v1/network/forward-auth/', prefix: true },
+    // DC-150: WG invite redemption — the redeemer has NO DashCaddy session
+    // (they got a link/QR). The token itself is the credential; the redeem
+    // route validates it. Without this the redemption page 401s at the gate.
+    { path: '/api/v1/network/wg/redeem/', prefix: true },
     { path: '/api/v1/auth/app-token/',   prefix: true },
     { path: '/api/v1/auth/login-page',   exact: true,  method: 'GET' },
     // Must be public: a fresh cross-subdomain visitor has no session yet by